What You Can't Say, and Who You Can't Say It To

The same case, five different conversations

Take a single investigation and imagine explaining it to five different people. The facts don't change. What you're allowed to say about them does.

With the subject or a third party, you say almost nothing, and what you do say has to be careful and firm. This is the hardest version by a wide margin, because the person on the other end usually has a real, sympathetic reason for asking. I recently deactivated an organization for fraud, and a third party reached out because they'd noticed it had disappeared from the platform. They wanted to know why, and understandably weren't satisfied with a standard "we can't share that information" response. My instinct in that moment could easily have gone one of two ways: over-explain to smooth things over, or get defensive because the same question kept coming at me from different angles. Neither actually helps. Empathy does. Understand where the person is coming from, match their tone, and hold the line on substance. Reiterate the policy, acknowledge that the frustration is fair, and don't confirm or deny anything about the specifics, without being a jerk about it. Warm and immovable at the same time turns out to be exactly the combination that de-escalates a conversation like that.

The audiences on the other end of the spectrum aren't ones you're managing risk with, they're ones you're working with. Your team or your lead gets everything: full detail, working theories, the half-formed hunches you're not ready to defend yet. Legal gets facts and exposure rather than your gut feeling, because facts are the only material they can actually act on. PR gets the narrowest slice of all, only what's needed to manage external risk, since every extra detail handed over is one more thing that could end up in a statement nobody meant to make. Different audiences, same underlying rule: give each one what they need to do their job, nothing more.

Leadership and the board get the high-level version, and this is where I think people underestimate how much restraint is actually required. I was recently asked to give leadership and board members statistics on our investigations: typologies, patterns, outcomes. That request came from about as internal as internal gets, the highest levels of the company, for entirely legitimate oversight reasons. I still kept my answer to patterns and typologies rather than the particulars of any individual case. No names. No identifying details about the organizations involved. Nothing traceable back to a specific person or case. It isn't about distrusting the audience. It's about keeping the matter confidential no matter who's asking, so the way you communicate upward doesn't quietly become the thing that tips someone off.

None of these five versions are lies. None of them are the full picture either. Each one is simply scoped to what that particular audience actually needs.

Tipping off, what it actually means

Tipping off has a specific, defined meaning in AML and fraud work: alerting someone, directly or indirectly, that they're under investigation or that a report has been filed about their activity. In many jurisdictions this crosses from bad practice into a genuine offense, because it hands a bad actor the chance to destroy evidence, move funds, or disappear before the investigation can conclude.

Most people avoid the direct version instinctively. Nobody calls a suspect and announces they're under investigation. It's the indirect versions that actually catch people: an answer to a third party that's a shade too specific, a tone that shifts just enough to signal something's wrong, timing that lines up too conveniently with a deactivation, or an internal report detailed enough that a name could be pieced back together by whoever eventually reads it. Being trusted or internal doesn't make an audience exempt from this risk. It just changes what the risk looks like.

The habit that protects you here is the same one from the leadership example above: default to the abstracted version. Patterns, typologies, and outcomes tell leadership whether the program is working and where risk is trending, without exposing the specifics that could compromise a live matter or identify a person. If a name or a detail feels necessary to make your point, that's usually the moment to step back and ask whether the point survives without it.

Consistency as its own signal

There's a layer to this that's easy to overlook: how consistently you communicate matters almost as much as what you say. An answer that shifts between conversations, softer one week, more guarded the next, becomes a signal in itself, both to a bad actor watching closely for what you know and to anyone reviewing your process later.

This gets more important once you're not the only person fielding these questions. When a whole team uses the same repeatable language for the same kinds of situations, the process gets stronger, not just any one person's answers. A third party who talks to two different investigators and hears two differently worded versions of the same policy has learned something, even if neither analyst technically said anything wrong. Standardized language closes that gap. It's also the only way the process actually scales. One analyst can hold their own answers consistent through memory and instinct. That falls apart across a growing team unless the consistency lives in the process itself rather than in any single person's head.

A standard, repeatable line isn't about sounding scripted. It's a bet that whatever gets said today would get said the same way next week, by you or by a teammate, regardless of who's asking or how frustrated they are. That bet protects the case. It also protects the team, because a defensible process is one where no single day, and no single person, becomes the reason something slipped through differently than it should have.